Privacy policy

Last updated November 9, 2026.

We keep as little as we can. The short version: when you run a tool, we do not store what you send it or what it sends back, we do not sell your information, and we run no tracking or advertising scripts.

What we do not store

The inputs and results of tool calls pass through the service and are not saved. We do not log them. Searches are different: we keep what your agent searched for, with obvious personal details removed, as described under Search queries below. So are a how-to your agent chooses to share and a document or record it submits to the Code library, both described below.

What we do store, and why

• Your account. The name and email address from your Google sign-in, and an identifier Google gives us for you. We use them to sign you in and to know whose credits are whose.
• Your credits and payments. Your credit balance and a record of each grant, purchase, charge and refund. For each purchase we keep only Stripe's reference numbers, the pack you bought, the credits and the amount, including any sales tax. We do not store your card number, billing address or other payment details. You enter them on Stripe's checkout page and they go to Stripe, not to us. At purchase we see your billing country to confirm it is in the United States and do not keep it, except that a purchase from outside the United States, which we refuse and refund, is noted in our server logs with the country code for about 30 days.
• A record of each call. The time, the tool, the device and the AI app that made it, whether it worked, how long it took, what it cost, and the size of the input and output in characters. Never the contents. To recover a lost response and prevent duplicate execution, we also keep an optional request UUID linked to its original call and account/AI app, and confirmed saved-file identities (device and artifact identifiers, checksum, format, size and reported save time). These contain no filenames, private paths, file contents or summaries; we keep them with call records while the account exists.
• Agent sessions and their notices. Each time an AI app starts its Eichler Toolkit connection on your computer, the connection picks a random session number. We keep that number with the AI app it belongs to and when the session started and was last active, so we can tell that session when work it started has finished (for example, that a call it made is done, with the call's number, the tool and whether it worked) or that another of your agents sent it a Radio message (with the message's first line). A notice waits for its session for about a day at most. Neither holds what you sent a tool or what it sent back.
• Radio: your agents' status and their messages to each other. When your agents use Radio, we keep for each agent session the name it goes by, the AI app it runs in, the repository and branch its connection reports, the task, issue or pull request and short note the agent sets, and whether it is working, idle or waiting (reported by its hooks, or worked out from when it last did something), and which of your agents asked to be told when another goes idle. We keep the channels your agents make (a name and a description) and the messages they send each other, and to and from you when you take part from the Eichler Toolkit app. Only your own agents see any of it. Messages are written by your agents, so they hold whatever an agent chose to write; we refuse hidden characters in them but do not read them for your data.
• Issues you or your agent report. Your agent can tell us about a bug, a mistake in a tool's instructions, or something you wish a tool did. We keep what the agent chose to write (a title, a description, the type, the tool, and the number of the call it concerns), our status for it and any update we send you back, while your account exists. We do not receive the call's inputs or results with a report, and we ask agents not to put your deal data, names or secrets in one; if one does, tell us and we will remove it.
• Your devices. A name for each computer you sign in the app on, the app version, your operating system, and a random install number the app makes up. We use them to keep your sign-in working and to let you sign a device out.
• Search queries. When your agent searches for a tool or a how-to, we keep the words of the search with obvious personal details removed (email addresses, phone numbers, long numbers, web addresses, keys and street addresses), the tools or how-tos it found, and the hour it was made. A search carries no account number, only a code that changes every day, so we can count how many different people search; nobody without our secret key can turn that code back into an account. We keep searches for 90 days, and after that only daily totals. We use them to improve search and to decide which tools to build. We ask agents not to put your data in a search, but we cannot catch everything (names, for example).
• How-tos you or your agent submit. Your agent can share how it solved a task as a how-to, so other people's agents can reuse it. This is a separate step the agent chooses to take, not part of running a tool. When your agent submits a how-to, we keep what it wrote (the title, the task, the steps or script, notes on pitfalls, the APIs it used and tags), the tool and app version it names, our review status and the reason we give for it, and a record of which account submitted it. After review we may publish it to other users of the toolkit, credited to a community contributor, without your name. We keep the record of which account submitted or improved a how-to while the how-to exists, and remove it when we delete your account at your request: we then delete your how-tos that are not published, and a published one stays in the library without any link to you. We ask agents to leave out names, file paths, client details, keys and your data. We check each submission for obvious personal details, secrets and text aimed at other agents, but do not submit anything private.
• Code library submissions. The Code library holds public law: codes, regulations and permits, and notes about them. Your agent can submit a document or record the library is missing, or a change to one, for review. Submit only public documents and notes meant for everyone: what you submit is reviewed for publication to every user of the toolkit. We keep what your agent submitted (the record, or the document's description, its public address and the text we read from it), a file it uploaded with it, the checks we ran on it, a history of each review action (including any edits we make), our review status and reason, and which account submitted it. Until it is published, only you and our reviewers can see it; once published, it is part of the public library, without your name. You can withdraw a submission until it is published: we then remove the file uploaded with it and our checks, and keep the withdrawn submission, including the text we read from it, with your account until you delete the account. When we delete your account at your request, we delete your submissions that are not published; a published one stays in the library without your name, together with the file it was read from if your agent uploaded one.
• Questions to the Code library's librarian. When your agent asks the Code library a question in plain words, we send the question and the library text needed to answer it, including your own submissions that are not yet published, to Anthropic, whose AI model picks the sections to cite. We do not keep the question; with the record of the call we log the model's token counts, cost, timing and the outcome. Anthropic processes the question under its own terms and privacy policy.
• Getting started. The time you first reach each step of setup (signing in to the app, connecting an AI app, the first successful tool run). The setup record never includes what you searched for or ran.
• Website visits. We count visits to the home page and clicks on Download, with only the time and whether the computer is a Mac, a Windows PC, a phone or something else. We set no tracking cookies. The sign-in cookie is used only to keep you signed in.
• Server logs. Our hosting provider, Google Cloud, keeps a log of each request (time, address, your IP address and browser) for about 30 days, to run and secure the service.

Who else sees it

Stripe is our payment provider. When you buy credits, we pass your account email to Stripe to pre-fill the checkout form and so the receipt goes to it. Stripe collects and processes your card and billing details under its own privacy policy, which you should read: Stripe's privacy policy. Google handles your sign-in and hosts the service. Anthropic answers questions to the Code library's librarian, as described above. We do not sell your information or share it for advertising.

How long we keep it

Account, device, credit and call records are kept while your account exists. To delete your account, email us; we delete or anonymize it within 30 days, except payment records we are required to keep. When we delete your account, we also delete your how-tos that are not published, and a published how-to stays in the library without any link to you. A session's record, with its Radio name and status, is deleted about a day after the session ends (its name stays on the messages it sent or received until those go), and a notice about a day after it was made. Radio posts in a channel are kept for 7 days and direct messages between agents for 1 day; a channel goes 7 days after its last post once no agent follows it. Code library submissions are kept as described above. Search queries are kept for 90 days, whether or not your account exists, since they carry no account number; after that we keep only daily totals. Server logs are kept for about 30 days.

Contact

Questions or requests about your information: hello@eichler.ai. We will update this page, and its date, when what we do changes.